- Enforcing jurisdiction
- Estonia · Geography does not establish applicable law.
- Confirmed applicable legislation
- No confirmed legal basis recorded.
- Privacy topics
DPA case 2.1.-1/24/181-367-3 – Complaint Upheld (Estonia, 2024)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Staffrent OÜ, a staffing agency, sent marketing emails without giving people a way to opt out. Even after being told to stop, they continued sending emails, which led to a complaint. This case highlights the importance of respecting people's wishes regarding marketing communications.
What happened
Staffrent OÜ sent direct marketing offers to a person without providing an option to opt out.
Who was affected
Individuals who received marketing emails from Staffrent OÜ without the ability to unsubscribe.
What the authority found
The DPA found that Staffrent OÜ failed to comply with direct marketing rules by not allowing users to opt out.
Why this matters
This case shows that companies must respect opt-out requests in marketing communications. Businesses should ensure they provide clear unsubscribe options to avoid complaints.
Source checks
Secondary-source text retrieved.
Review needed — 18 October 2026.
Processing notes: articles corrected, national law identified, amount discrepancy.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On 26 August 2022 a data subject lodged a complaint according to which they received direct marketing offers to their e-mail address from various e-mail addresses belonging to Staffrent OÜ, a personnel outsourcing and staffing agency (‘controller’). The offers did not contain information on the possibility to opt out of receiving them. The data subject repeatedly contacted the controller, expressing their wish to not receive the direct marketing offers and prohibited the controller from further processing their contact details. The DPA started an investigation into the matter and sent an inquiry to the controller regarding the allegations made against them. The controller replied on 24 October 2022 that they informed the data subject that no further offers will be sent to their e-mail address. Additionally, they added a note to their direct marketing offers regarding an option to unsubscribe. However, on 27 October 2022, the data subject received another direct marketing offer from the controller, again without an information to opt-out. In its reply to the DPA, the controller stated that the e-mail in question was sent in error and promised to seek help from IT specialists. As a result, the DPA closed the monitoring procedure. On 27 September 2023, the DPA received a letter of warning from another customer to whom the controller sent direct marketing offers omitting the information on how to opt-out. The controller explained to the DPA that their software broke down and the opt-out service did not work. However, the data subjects were guaranteed the possibility to send them a request for deletion of their data. The controller claimed that until the problem is solved, they will stop advertising. On 8 February 2024, another customers’ complaint to the DPA contained the same allegations regarding the controller. To begin with, the DPA stated that the processing in question concerns electronic direct marketing within the meaning of Section 5(1) of the Informatio
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2.1.-1/24/181-367-3 in EE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2.1.-1/24/181-367-3 - Estonia (2024). Retrieved from cookiefines.eu
Last updated: